gcp-ci-dwd-enter-org

id: gcp-ci-dwd-enter-org
emits: CanEnterOrganization
description: A DWD SA with both admin-directory and cloud-platform scopes can act as a super-admin and
  thereby obtain GCP Organization-level control.
match:
- - sa: null
  - CanDelegate
  - superadmin: null
- - sa: null
  - HasPolicy
  - dwd_binding: null
where:
- node_type(?sa) == ServiceAccount
- node_type(?superadmin) == HumanIdentity
- ?superadmin.is_super_admin == true
- ?dwd_binding.type == 'DWDScopeBinding'
- ?dwd_binding.scopes contains admin_scope
- ?dwd_binding.scopes contains 'https://www.googleapis.com/auth/cloud-platform'
emit:
  source_type: Identity
  target_type: Organization
  source: ?sa
  target: <linked GCP Organization>
  permissions: []
  conditions:
  - service_state
  state_logic: 'ACTIVE when: (1) the DWD SA has admin.directory.* Admin SDK scopes (admin_scope) AND cloud-platform
    GCP API scope in ?dwd_binding.scopes, (2) the domain has at least one active super-admin user, (3)
    the SA''s DWD grant is active, and (4) the SA has at least one active service account key. CONDITIONAL(service_state)
    if the DWD SA has admin.directory.* scopes but lacks cloud-platform scope (can call Admin SDK but
    not Resource Manager API), or if all super-admin accounts are suspended or if the SA has no active
    keys. BLOCKED if the DWD grant has been revoked or if the Workspace org is not linked to a GCP organization.'
  confidence: 0.9
  derived_from:
  - gcp-ci-dwd-sa-delegates-user (CanDelegate ?sa -> ?superadmin)
  - ?superadmin.is_super_admin == true
  - ?dwd_binding.scopes contains both admin-level scope (admin.directory.*) and cloud-platform
  false_positive_note: "This path REQUIRES both admin.directory.* scopes (for Admin SDK) AND cloud-platform\
    \ scope (for GCP Resource Manager). Admin scopes alone are INSUFFICIENT \u2014 a DWD SA with only\
    \ admin.directory.* scopes can call Admin SDK as a super-admin but will receive an authorization error\
    \ when calling resourcemanager.organizations.setIamPolicy. Do NOT emit ACTIVE if only admin scopes\
    \ are present; emit CONDITIONAL(service_state) instead. A narrow- scope DWD SA (e.g. gmail.readonly)\
    \ cannot call the GCP Resource Manager API even while acting as a super-admin. Narrow-scope DWD SAs\
    \ yield user-level data access but not GCP org control. Always verify that at least one non-suspended\
    \ super-admin exists in the domain before asserting ACTIVE state. The SA must also have an active\
    \ service account key to sign JWTs for DWD. This rule deliberately surfaces the high-impact path for\
    \ org-level attack queries without requiring the analyst to manually chain CanDelegate \u2192 CanGrantPermission\
    \ \u2192 Controls(org)."
  narrative: '{sa.name} has Domain-Wide Delegation with both admin.directory.* and cloud-platform scopes
    and can impersonate any Workspace super-admin in the domain (if it has an active private key). By
    acting as a super-admin and using the cloud-platform scope, {sa.name} can call the GCP Resource Manager
    API and grant any GCP IAM role in the linked organization, effectively achieving full GCP Organization
    control.'